ALT-PU-2024-18273-1

Package update libsoup3.0 in branch sisyphus

Version3.6.0-alt1

Published2024-09-19

Max severityHIGH

Severity:

Closed issues (2)

HIGH7.5

Уязвимость библиотеки libsoup графического интерфейса GNOME, позволяющая нарушителю выполнять атаку "контрабанда HTTP-запросов"

Published: 2025-06-09Modified: 2026-03-04

CVSS 3.xHIGH 7.5

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS 2.0HIGH 7.8

CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:C/A:N

References

HIGH7.5

GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header.

Published: 2024-11-11Modified: 2025-11-03

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References